CUST-WP-0011-T07 done: cluster State Hub is primary (exact-count restore, tunnel rewire)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

workplans/CUST-WP-0011-state-hub-threephoenix-migration.md

@@ -343,11 +343,9 @@ port-forwards were removed after verification.
 
 ```task
 id: CUST-WP-0011-T07
-status: todo
+status: done
 priority: medium
 state_hub_task_id: "ff1de25e-c301-4b86-9420-84dfe72e565e"
-needs_human: true
-intervention_note: "Requires explicit approval to freeze WSL2 writes and make the cluster State Hub the primary endpoint."
 ```
 
 With human approval, freeze WSL2 writes, take a final dump, restore it to the
@@ -363,6 +361,18 @@ Accepted approaches:
 **Done when:** `get_state_summary()` and dashboard live data are served by the
 cluster State Hub, and WSL2 is no longer receiving normal writes.
 
+Result: completed 2026-07-03 with explicit operator approval ("go forward with
+1 and 2 and 3"). Sequence: cluster image refreshed to `ea1fd23` (adds the
+add_progress_event workplan_id alias; schema head `e9f0a1b2c3d4` unchanged);
+WSL2 uvicorn stopped (freeze); final `pg_dump` from `infra-postgres-1`
+restored into CNPG `state-hub-db`/`state_hub` with `SET ROLE state_hub`
+ownership; row counts matched exactly (633 workplans, 3964 tasks, 8192
+progress events, 14 topics, 1933 token events); private access rewired via
+ops-bridge `state-hub-primary` forward tunnel so `127.0.0.1:8000` serves the
+cluster hub. The railiance01 automation chain (`:18000`) verified intact.
+First primary-served write: progress event `56aab39b`. WSL2 fallback restart:
+`bridge down state-hub-primary && cd ~/state-hub && make api`.
+
 ---
 
 ### T08 — Stabilise with WSL2 retained as fallback